How does Roave Security Advisories compare to SensioLabs Security Checker?

Roave proactively blocks vulnerable packages during installation via Composer, while SensioLabs Security Checker reactively scans already installed dependencies. Roave is better for preventing issues upfront, but SensioLabs covers runtime checks.

How to manually check for vulnerabilities without updating dependencies?

Run `composer update --dry-run roave/security-advisories` to trigger a security check without making changes, as specified in the README. This allows proactive auditing without affecting your project.

Does it work with private Composer repositories?

Yes, it integrates with Composer's dependency resolution, but effectiveness depends on whether the advisory databases include vulnerabilities for private packages. You might need to supplement with custom checks.

What happens if a false positive blocks a necessary package?

You may need to temporarily disable the package or adjust constraints, but this could expose you to risks. The README doesn't provide built-in bypass mechanisms, so manual intervention is required.

Can I integrate it into a CI/CD pipeline to fail builds on vulnerabilities?

Yes, by adding a step that runs `composer update --dry-run` and checks for errors, you can prevent merging code with vulnerable dependencies. However, this only catches issues during update cycles.

Is there a stable version I can lock to for reproducibility?

No, the package only provides `dev-latest` to ensure real-time protection, as locking to a version would not make sense for security advisories, which is a trade-off for stability.

Open-Awesome

Roave Security Advisories

MIT

A Composer package that blocks installation of PHP dependencies with known security vulnerabilities.

GitHub

2.9k stars111 forks0 contributors

What is Roave Security Advisories?

Roave Security Advisories is a Composer package that blocks the installation of PHP dependencies with known security vulnerabilities. It integrates into the Composer workflow to automatically check packages against updated security advisory databases, preventing developers from accidentally introducing vulnerable code into their projects.

Target Audience

PHP developers and teams using Composer for dependency management who want to automate security checks and prevent vulnerable dependencies from being installed.

Value Proposition

It provides a simple, automated way to enforce security at the dependency installation stage without runtime overhead, leveraging authoritative sources like FriendsOfPHP/security-advisories and GitHub Advisory Database for comprehensive coverage.

Overview

:closed_lock_with_key: Security advisories as a simple composer exclusion list, updated daily

Use Cases

Best For

Preventing installation of vulnerable PHP packages during development
Automating security checks in Composer-based workflows
Enforcing supply chain security for PHP applications
Integrating vulnerability scanning into CI/CD pipelines
Maintaining secure dependency management in team environments
Blocking known security issues before deployment

Not Ideal For

Projects requiring runtime vulnerability scanning or monitoring of already installed dependencies
Libraries or packages being distributed as dependencies themselves, since it's only suited for root projects
Teams using dependency managers other than Composer (e.g., npm, pip, or RubyGems)
Environments with infrequent dependency updates where the lock file is rarely refreshed, reducing check frequency

Pros & Cons

Pros

Automatic Vulnerability Blocking

Prevents `composer require` or `composer update` from installing packages with known security issues, as demonstrated in the README with examples like blocking old Symfony versions.

Zero Runtime Overhead

Functions purely as a version constraint in `composer.json` with no API or classes, ensuring no performance impact on the application.

Real-Time Updates

Leverages hourly updates from FriendsOfPHP/security-advisories and GitHub Advisory Database, providing up-to-date protection against new vulnerabilities.

Dev-Only Safety Net

Designed to be installed as a `require-dev` dependency, avoiding production deployment issues while securing development workflows.

Cons

Installation-Only Checks

Only executes checks during `composer require` or `update`, not for vulnerabilities in already installed packages unless manually triggered with `--dry-run`, leaving runtime gaps.

Root Project Limitation

The README states it's only suited for installation in the root of deployable projects, making it ineffective for libraries or sub-dependencies that need security checks.

External Data Dependency

Relies on third-party advisory databases; if these sources are incomplete, delayed, or miss advisories, vulnerabilities might not be blocked, as admitted in the sources section.

Frequently Asked Questions

Related Projects

SQLMap

Automatic SQL injection and database takeover tool

Stars38,767

Forks6,415

Last commit2 days ago

Zap

The ZAP by Checkmarx Core project

Stars15,993

Forks2,672

Last commit7 days ago

PHPSecLib

PHP Secure Communications Library

Stars5,600

Forks908